Data loss prevention controls

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What is the main job of a data loss prevention (DLP) control?

A Stop outsiders from guessing user passwords

B Detect and block sensitive data from leaving the organisation

2. A DLP tool scans an outgoing email and finds an attached file full of customer credit card numbers. What should it do?

A Block the email and alert security staff

B Let the email through because it is from a staff member

3. Which USB restriction is an example of a DLP control?

A Blocking copying of sensitive files to unapproved USB drives

B Installing a larger hard drive in each computer

4. An employee exports 50,000 customer records in one go. What would a DLP control most likely do?

A Raise an alert about the unusually large export

B Ignore it, because size does not matter

5. Which channel can DLP controls monitor to stop sensitive data leaving?

A Only the colour of the login screen

B Email, USB and file uploads

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1DLP rule: block email if attachment contains tax file numbers		AThis does not restrict USB use or detect transfers, so sensitive data can leave unnoticed. DLP should block or limit USB copying and record or alert on it.
2DLP rule: if export > 5000 rows then alert security team		BRaises an alert when someone exports an unusually large amount of data so staff can review a risky transfer
3DLP can restrict USB devices so sensitive files cannot be copied to removable storage		CStops a sensitive file transfer by scanning outgoing email for protected data and blocking it before it leaves
4DLP detects sensitive data in an upload and blocks it from leaving the organisation		DScanning after sending is too late because the sensitive data has already left. DLP must inspect and block the transfer before it leaves the organisation.
5DLP rule: allow all USB copying but log nothing		EIF upload contains "CONFIDENTIAL" THEN block upload
6DLP rule: scan email only after it has been sent		FUSB_policy = "block write to removable drives"

Definitions

Data loss prevention (DLP)

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF file.label = "Confidential" THEN _____ email_send END IF

IF device.____ = "USB" THEN BLOCK file_copy END IF

IF export.rows _ 10000 THEN ALERT security_team END IF

IF export.rows > 10000 THEN _____ security_team END IF

IF file.sensitive ___ upload.external THEN BLOCK upload END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF action = OPEN_FILE

B AND label = SENSITIVE

C THEN BLOCK transfer

D LOG event

Question 2

A IF rows_exported > 5000

B HOLD export

C SEND alert TO export_user

D ENDIF

Question 3

A IF channel = EMAIL

B AND attachment has card_number

C THEN ALLOW email

D NOTIFY sender

Question 4

A IF action = WEB_UPLOAD

B AND file.label = PUBLIC

C AND site NOT IN approved_list

D THEN BLOCK upload

Question 5

A SET limit = 1000

B SET rows = COUNT(export_rows)

C IF rows > limit

D CLEAR alert

E ENDIF

Answer Key

Data loss prevention controls

Section A: Quick Questions

B — Detect and block sensitive data from leaving the organisation

A — Block the email and alert security staff

A — Blocking copying of sensitive files to unapproved USB drives

A — Raise an alert about the unusually large export

B — Email, USB and file uploads

Section B: Match the Pairs

DLP rule: block email if attachment contains tax file numbers → Stops a sensitive file transfer by scanning outgoing email for protected data and blocking it before it leaves

DLP rule: if export > 5000 rows then alert security team → Raises an alert when someone exports an unusually large amount of data so staff can review a risky transfer

DLP can restrict USB devices so sensitive files cannot be copied to removable storage → USB_policy = "block write to removable drives"

DLP detects sensitive data in an upload and blocks it from leaving the organisation → IF upload contains "CONFIDENTIAL" THEN block upload

DLP rule: allow all USB copying but log nothing → This does not restrict USB use or detect transfers, so sensitive data can leave unnoticed. DLP should block or limit USB copying and record or alert on it.

DLP rule: scan email only after it has been sent → Scanning after sending is too late because the sensitive data has already left. DLP must inspect and block the transfer before it leaves the organisation.

Section C: Definitions

Data loss prevention (DLP) — Controls that detect and block sensitive data leaving an organisation, such as by email, USB or upload, and alert staff to risky transfers like large exports.

Section D: Fill in the Blanks

IF file.label = "Confidential" THEN
    BLOCK email_send
END IF

IF device.type = "USB" THEN
    BLOCK file_copy
END IF

IF export.rows > 10000 THEN
    ALERT security_team
END IF

IF export.rows > 10000 THEN
    ALERT security_team
END IF

IF file.sensitive AND upload.external THEN
    BLOCK upload
END IF

Section E: Spot the Error

A — This DLP rule is meant to stop sensitive data being copied to a USB drive. Opening a file is not a USB transfer, so the first line should check for action = USB_COPY.

C — An alert about a large export should go to the security team, who can review the risky transfer. It should not go only to the person doing the export. The line should be SEND alert TO security_team.

C — A DLP control must block an email that carries sensitive data such as card numbers. Allowing it defeats the purpose. The line should be THEN BLOCK email.

B — The rule should block uploads of sensitive files to unapproved sites. Checking for PUBLIC files would block harmless uploads and let sensitive ones through. It should be AND file.label = SENSITIVE.

D — When an export is larger than the limit, DLP should raise an alert so staff can check it. Clearing the alert hides the risky export. The line should be RAISE alert.